open record looks like openat

John D. Ramsdell ramsdell at mitre.org
Fri Jul 27 18:14:06 UTC 2007


ramsdell at mitre.org (John D. Ramsdell) writes:

> I carefully studied the output of my analysis program, and found one
> particularly odd line of output.  I traced it back to an interesting
> audit event in the raw log (syscall 5 is the open system call):

I found the place in the source for the program that generates this
system call.  It is a call to freopen on stderr.

John




More information about the Linux-audit mailing list